#Unifi log parsing

1 messages · Page 1 of 1 (latest)

red siren
#

I have set up my UBNT EdgeRouter to send logs to crowdsec via syslog. I have added crowdsecurity/unifi. I have the acquisition configured with type unifi. According to the instructions here https://app.crowdsec.net/hub/author/crowdsecurity/collections/unifi. I can see the stats and although I am only sending relevant log entries over, the stats say all lines are unparsed.

I tried to run explain on a raw log entry with the type specified as unifi as the type. It shows the entry was parsed by non-syslog parser instead of the unifi-logs. If I specify type as syslog, it fails to be parsed by anything and I see that the unifi-logs is just below non-syslog.

I don't know if this is a red herring and there is some other reason for not parsing logs.

CrowdSec Console
Hub collection

Use CrowdSec Console to visualize security data, manage dynamic blocklists, and gain real-time intelligence on IPs. Enhance your threat response capabilities.

mint elkBOT
#
Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

© Created By WhyAydan for CrowdSec ❤️ ·
mint elkBOT
#

This has now been resolved. If you think this is a mistake please run /unresolve

red siren
#

I switched the acquisition type to syslog and it seems to be parsing now.

narrow marsh